CVE-2026-50162: Oras-Project Oras-Go

Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.

Affected products

• Oras-Project Oras-Go: before 2.6.1 (fixed in 2.6.1)

Published 2026-07-17. Last modified 2026-07-23.